Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

WannaCry ransomware explained: What it is, how it infects, and who was responsible

Josh Fruhlinger | Sept. 28, 2017
Stolen government hacking tools, unpatched Windows systems, and shadowy North Korean operatives made WannaCry a perfect ransomware storm.

Hutchins not only discovered the hard-coded URL but paid $10.96 to register the domain and set up a site there, thus helping blunt, though not stop, the spread of the malware. Shortly after being hailed as a hero for this, Hutchins was arrested for supposedly developing different malware in 2014. He has proclaimed his innocence.


WannaCry patch 

Ironically, the patch needed to prevent WannaCry infections was actually available before the attack began: Microsoft Security Bulletin MS17-010, released on March 14, 2017, updated the Windows implementation of the SMB protocol to prevent infection via EternalBlue. However, despite the fact that Microsoft had flagged the patch as critical, many systems were still unpatched as of May of 2017 when WannaCry began its rapid spread.

For those unpatched systems that are infected, there is little remedy beyond restoring files from a safe backup — so let that be a lesson that you should always back up your files. While those monitoring the bitcoin wallets identified in the extortion message say that some people are paying the ransom, there's little evidence that they're regaining access to their files


WannaCry and Windows 10

As noted, Microsoft released a patch for the SMB vulnerability that WannaCry exploits two months before the attack began. While unpatched Windows 10 systems were vulnerable, the automatic update feature built into the OS meant that almost all Windows 10 systems were protected by May of 2017.

The Microsoft SMB patch was initially only available for currently supported versions of Windows, which notably excluded Windows XP. There are still millions of internet-connected Windows XP systems out there — including at Britain's National Health Service, where many WannaCry attacks were reported — and Microsoft eventually made the SMB patch available for older versions of the OS as well. However, a later analysis found that the vast majority of WannaCry infections struck machines running Windows 7, an operating system Microsoft does still support.


Symantec fingers the Lazarus Group

After the initial dust settled, various security researchers began working to try to figure out the origins of WannaCry. Symantec had a provocative take: they believed that the code might have a North Korean origin. They laid out the evidence in a blog post, where they discussed a little-known fact: that WannaCry had actually been circulating for months before it exploded across the internet on May 12, 2017. This earlier version of the malware, dubbed Ransom.Wannacry, used stolen credentials to launch targeted attacks, and there were "substantial commonalities in the tools, techniques and infrastructure used by the attackers” between this version of WannaCry and those used by the Lazarus Group.


Previous Page  1  2  3  Next Page 

Sign up for Computerworld eNewsletters.